Feeds

Huawei: 'trust us, we are being transparent'

Security chief advances charm offensive with 'our stuff is made all over' spiel

Beginner's guide to SSL certificates

In an environment that's increasingly hostile to Chinese tech companies, Huawei has put forward its case for attitudes to be revised.

Speaking to the CeBIT Australia conference in Sydney, the company's global cyber security officer John Suffolk said there's little difference between Huawei and any other major vendor: its products come from a host of suppliers in a huge number of countries.

Seventy percent of the hardware found in Huawei's equipment comes from outside China, Suffolk claimed, and 32 percent of it comes from American suppliers. A similar tale can be told for software, he said, with contributions from around the world.

“We go, as all companies do, to where we can find the best researchers, the best talent around the world,” he said. “We go where we have talent, where the economic conditions are right.”

He described relocation of operations to follow services as “a core competency of every company”, something which underlines the need for any vendor to treat security as a global issue that flows all the way through every supply chain.

Noting that the world contains many, many places where any product could be compromised, he added that it's easier in general to bribe an insider than to launch a concerted and successful attack from the outside.

He also called on customers – particularly governments and large enterprises – to be far more activist in what they demand form vendors.

“If you, as governments or large enterprises, don't say to your vendors 'this is what good security looks like', don't expect the vendors to do anything about it,” he said.

He said that “highly variable” responses from vendors are an indication that they don't have good security procedures in place, but rather are “making it up as they go along”. Such are the opportunities to compromise a product, in a global supply chain, that no vendor can offer secure products “unless you have repeatable, standard processes.”

Transparency, he said, is vital to security and information assurance, and he claimed that Huawei is “the most audited company in the world … we can trace 96 percent of all our components, except non-tech things like cables and batteries”.

Customers should ask vendors “can you trace everything from a requirement through to code and back again?” Suffolk added.

“We welcome being audited, inspected, poked and prodded and probed,” he said. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.